Exceptional network recovery#

Authority loss does not authorize a replacement committee or permit restored journals to issue old-network grants. Exceptional recovery creates a new network identity and a new incarnation with a complete independently accepted bootstrap. The offline tools are in the separate HyperNetSuite network recovery commands.

Kinds115 and116 encode a threshold proposal and explicit client acceptance. They do not confer current authority, membership, hosting or content access. The latest recovery policy authenticated by the retained requester floor supplies all eligible custody keys and its threshold. Committed custody replacement is retained; the bootstrap generation is never substituted for a newer floor. Duplicate keys, foreign signatures and mixed declaration payloads refuse. Shared custody also requires distinct enrolled principal identities. Signatures cannot prove that different people control those identities.

Different threshold-authorized successors can coexist if a custodian equivocates. Observed conflicts are durable and block automatic acceptance; a timestamp, epoch, signature count or mirror count does not select a winner. Independent client acceptance binds the exact successor bootstrap fingerprint and does not prove that unseen conflicts are impossible.

The successor starts with new genesis policy. No old grant, invitation, consent, roster, treaty or service authorization is imported as live state. Optional historical inventory commitments remain non-authoritative. Fresh publication, identity continuity and host consent are required for any later import.

Healthy committee replacement is a separate same-network protocol. Recovery signatures cannot stand in for its old and new quorums or release a halted old authority. The installed runtime does not restore lost signing history from a recovery declaration.